生成密钥和证书
秘钥和证书请求文件
在 nginx 的 conf 创建 crt 目录，生成私钥和证书请求文件
[123@123 crt]$ openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
填写证书请求文件的信息
Generating a RSA private key
.....+++++
.................................................+++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BJ
Locality Name (eg, city) []:beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hligy
Organizational Unit Name (eg, section) []:hligy
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:baasd@asd.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:
查看秘钥
[123@123 crt]$ openssl rsa -text -in server.key
查看证书请求文件
[123@123 crt]$ openssl req -text -in server.csr
证书
给自己颁发一个证书（想让浏览器变绿就去 CA 拿着 私钥 和 证书请求文件去申请，变绿要钱）
[123@123 crt]$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
查看证书
[123@123 crt]$ openssl x509 -text -in server.crt
配置 nginx
添加 SSL 和 HTTP2 模块
查看是否有 --with-http_ssl_module --with-http_v2_module，http2 需要 openssl-1.0.2 和 nginx-1.9.5 之后的版本。
[123@123 sbin]$ ./nginx -V
nginx version: nginx/1.19.6
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 0.9.8xxxxxxxx忘记了
TLS SNI support enabled
configure arguments: --prefix=/home/xxx/nginx --with-http_stub_status_module --with-pcre
没有的话进入 nginx 的源码包，在原来 ./configure 后添加 --with-http_ssl_module --with-http_v2_module（如果 openssl 版本低就加上自己高版本 openssl 源码的位置 --with-openssl=/home/xxx/openssl-1.x.xx ， --with-openssl 配置的是 openssl 压缩包解压后的源码路径。），重新执行
[123@123 nginx-1.19.6]$ ./configure --prefix=/home/xxx/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-openssl=/home/xxx/openssl-1.0.2j --with-pcre
执行 make 重新编译（自定义的 openssl 版本太高会因为 perl 版本太低导致失败）。停掉 nginx，备份原来的启动脚本 nginx，拷贝 objs 目录下新编译的启动脚本到原脚本位置，再次查看显示添加成功。
[123@123 sbin]$ ./nginx -V
nginx version: nginx/1.19.6
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-55)
built with OpenSSL 1.0.2j 26 Sep 2016
TLS SNI support enabled
configure arguments: --prefix=/home/xxx/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-openssl=/home/xxx/openssl-1.0.2j --with-pcre
修改 nginx.conf
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
gzip on;
gzip_comp_level 6;
gzip_min_length 1k;
gzip_types text/plain text/css text/xml text/javascript text/x-component application/json application/javascript application/x-javascript application/xml application/soap+xml application/xhtml+xml application/rss+xml application/atom+xml application/x-font-ttf application/vnd.ms-fontobject image/svg+xml image/x-icon font/opentype;
keepalive_timeout 65;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
'"$upstream_addr" "$upstream_status" "$upstream_response_time" "$request_time"';
#access_log logs/access.log main;
upstream tomcat {
server 127.0.0.1:9001;
server 127.0.0.1:9002;
server 127.0.0.1:9003;
}
server {
listen 8443 ssl http2 default_server;
server_name localhost;
ssl_certificate crt/server.crt;
ssl_certificate_key crt/server.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https; # 如果设置http rewrite https就把https换成$scheme，这为了让tomcat知道真正请求协议
proxy_redirect off;
proxy_connect_timeout 240;
proxy_send_timeout 240;
proxy_read_timeout 240;
# note, there is not SSL here! plain HTTP is used
proxy_pass http://tomcat;
}
}
}
最后检查一下配置文件。
[123@123 sbin]$ ./nginx -t
nginx: the configuration file /home/xxx/xxx/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /home/xxx/xxx/nginx/conf/nginx.conf test is successful
修改 Tomcat 的 server.xml
修改所有的 redirectPort。
<Connector port="8001" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="9001"/>
<Connector port="8002" protocol="AJP/1.3" redirectPort="9001" />
在 <Host></Host> 中添加（ httpsServerPort 不修改）
<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
remoteIpProxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto"
httpsServerPort="9001"/> <!-- httpsServerPort 默认是 443 -->
最后
启动之后测试发现 http2 和 http 差不多，甚至还快了......（单独使用 tomcat 升级后测试慢了 20ms，升级文档参考 tomcat 5.5 6.0 7.0 8.0 官方文档）
参考
openssl、x509、crt、cer、key、csr、ssl、tls 这些都是什么鬼?